Skip to main content
SSetodDocsOpen app →

Security and what's missing

What happens to your credentials and your content, and an honest list of what this platform does not do yet.

Credentials

Every token, API key and password you connect is encrypted before it is stored, and decrypted only at the moment a tool needs to make a call. They are never shown back to you in the interface and never included in a run transcript.

You can revoke access from the other side at any time, and it takes effect immediately: remove the app from your Google account, revoke the bot token in BotFather, end the session in Telegram's device list, or roll the key in your OpenAI account.

Where your content goes

When an agent runs, the material it is working with - the emails it read, the messages it saw - is sent to the AI provider the agent runs on. With your own key that is your OpenAI or Anthropic account under your agreement with them; on Setod-managed models it is sent to OpenAI or Anthropic under Setod's account, under their API terms (no training on API data). It is not used to train anything here.

Run transcripts are stored so you can audit what happened. They contain whatever the agent read and wrote, so treat them as being as sensitive as the accounts behind them.

Agents act with your authority

An agent has exactly the permissions of the accounts you gave it, and it acts as you. It cannot tell a genuine customer email from one crafted to manipulate it, so be deliberate about which agents can send messages to the outside world, and read the first few runs of anything new. Responsibility for what your agents do rests with you - see the Terms of Service and Privacy Policy.

Platform security measures

  • Rate limiting. Authentication and agent-run endpoints are rate-limited per IP to prevent abuse. The auth endpoints allow 30 requests per minute; agent runs 30, the assistant 60, knowledge-from-URL and connector validation 20 per minute.
  • Security headers. Every response includes X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: strict-origin-when-cross-origin, and Strict-Transport-Security on HTTPS.
  • Session revocation. Logging out immediately invalidates your session token — if someone copies your cookie, it stops working the moment you sign out from any device.
  • SSRF protection. URLs you provide for knowledge, MCP servers, and webhooks are validated to block requests to private networks, localhost, and cloud metadata endpoints before any connection is made.
  • Custom code isolation. Custom code runs in an isolated AWS account with no permissions and no network unless you enable it.
  • Voice WebSocket security. The WebSocket connection that handles live phone calls is protected by a short-lived HMAC-signed token — Twilio must present a valid token generated at call setup time, preventing unauthorised connections to the voice stream.

Still not built

  • Rich email. Sending is plain text only, with no formatting and no attachments.
  • Full email bodies. Agents read sender, subject and a preview snippet, not the whole message.
  • Manual reply delivery. The human takeover reply box records messages for context, but does not send them through the channel automatically. You still need to reply in Telegram, WhatsApp, etc. directly.

Now available

  • Message-arrival triggers. Agents can react the instant a message lands on Telegram, WhatsApp, Instagram, Twilio SMS, and inbound webhooks. Add a channel trigger on the agent's When it runs tab.
  • Tool approvals. Require sign-off before an agent sends a message or takes any other action. Mark individual tools as “requires approval” on the agent's edit page — the agent pauses mid-run and waits until you approve or reject on the Approvals page. See the Tool approvals help page for details.
  • Voice / phone calls. Agents can now answer inbound phone calls via Twilio in real time, with a full call transcript saved to the Conversations inbox after each call.

Still stuck?

Start with the run transcript - it answers most questions about what an agent did and why. If the behaviour still does not make sense after reading it, the instructions are the next place to look.